Systems and Methods for Intermediate Message Authentication in a Switched-Path Network

1. A method comprising: passing a first copy of an electronic or optical message deriving from a sender and bound for a receiver through communication nodes of a switched-path network; and when the first copy of the electronic or optical message passes through each of one or more of the communication nodes, using authentication logic of that communication node to: generate a respective authentication tag based on the first copy of the electronic or optical message and an intermediate authentication key, wherein the respective authentication tag is configured to enable a third-party authentication authority to authenticate the first copy of the electronic or optical message to identify whether the first copy of the electronic or optical message has been tampered with or corrupted upon arrival at that communication node at least partially by: receiving a second copy of the electronic or optical message from the sender; generating a second authentication tag using the second copy of the electronic or optical message and the intermediate authentication key; and comparing the respective authentication tag received from the communication node and the second authentication tag to identify whether the first copy of the electronic or optical message is authentic; and identify, independently of the third-party authentication authority, whether the first copy of the electronic or optical message is authentic using an end-to-end authentication key, wherein the first copy of the electronic or optical message comprises an end-to-end authentication tag generated by the sender using the end-to-end authentication key.

2. The method of claim 1 , wherein the switched-path network comprises an optical transport network (OTN).

3. The method of claim 1 , wherein each of the one or more of the communication nodes authenticates the first copy of the electronic or optical message to identify whether the first copy of the electronic or optical message has been tampered with or corrupted upon arrival at that communication node using the end-to-end authentication key that is also configured to be used to authenticate the first copy of the electronic or optical message at the receiver.

4. The method of claim 1 , wherein each of the one or more of the communication nodes authenticates the first copy of the electronic or optical message to identify whether the first copy of the electronic or optical message has been tampered with or corrupted upon arrival at that communication node using the intermediate authentication key.

5. The method of claim 1 , wherein the one or more of the communication nodes comprises all of the communication nodes of the switched-path network.

6. The method of claim 1 , wherein each of the one or more of the communication nodes is configured to generate respective authentication tags for every electronic or optical message passed through the switched-path network.

7. The method of claim 1 , wherein each of the one or more of the communication nodes is configured to generate the respective authentication tag at a periodic, random, or statistical sampling interval of electronic or optical messages passed through the switched-path network.

8. The method of claim 1 , comprising, using at least one of the one or more communication nodes or using the third-party authentication authority, or both, determining that a communication node prior to one of the one or more communication nodes is a troublesome communication node that has tampered with or corrupted the first copy of the electronic or optical message when the first copy of the electronic or optical message is identified as not authentic upon reaching the one of the one or more communication nodes.

9. The method of claim 8 , comprising, using a control plane of the switched-path network, routing future messages around the troublesome communication node to prevent or reduce tampering with or corruption of future electronic or optical messages.

10. The method of claim 1 , wherein the respective authentication tag is configured to enable the third-party authentication authority to identify whether the first copy of the electronic or optical message has been tampered with or corrupted upon arrival at that communication node at least partially by: identifying whether the first copy of the electronic or optical message is authentic when the first copy of the electronic or optical message arrives at that communication node at least partially by: receiving the respective authentication tag generated by that communication node; identifying the first copy of the electronic or optical message as being authentic when the respective authentication tag matches the authentication tag; and identifying the first copy of the electronic or optical message as not being authentic when the respective authentication tag does not match the second authentication tag.

11. The method of claim 1 , wherein the authentication logic at least partially authenticates the first copy of the electronic or optical message to enable identification of whether the first copy of the electronic or optical message was tampered with or corrupted by a troublesome communication node that handled the first copy of the electronic or optical message prior to that communication node.

12. A system comprising: an authentication authority that: receives a first copy of an electronic or optical message from a sender; generates a first authentication tag using the first copy of the electronic or optical message and a first authentication key; and identifies whether a second copy of the electronic or optical message is authentic when the second copy of the electronic or optical message passes through one of a plurality of communication nodes of a first switched-path network at least partially by: receiving a second authentication tag generated by the one of the plurality of communication nodes of the first switched-path network using the second copy of the electronic or optical message and the first authentication key; comparing the first authentication tag and the second authentication tag; identifying the second copy of the electronic or optical message as being authentic when the first authentication tag matches the second authentication tag; and identifying the second copy of the electronic or optical message as not being authentic when the first authentication tag does not match the second authentication tag; and the first switched-path network, wherein the first switched-path network comprises the plurality of communication nodes, wherein the one of the plurality of communication nodes: generates the second authentication tag using the second copy of the electronic or optical message and the first authentication key; sends the second authentication tag to the authentication authority to enable the authentication authority to identify whether the second copy of the electronic or optical message is authentic; and identifies, independently of the authentication authority, whether the second copy of the electronic or optical message is authentic using a second, end-to-end, authentication key, wherein the second copy of the electronic or optical message comprises an end-to-end authentication tag generated by the sender using the second, end-to-end, authentication key.

13. The system of claim 12 , wherein the authentication authority: generates a third authentication tag using the first copy of the electronic or optical message and a third authentication key; and identifies whether the second copy of the electronic or optical message is authentic when the second copy of the electronic or optical message passes through one of a plurality of communication nodes of a second switched-path network at least partially by: receiving a fourth authentication tag generated by the one of the plurality of communication nodes of the second switched-path network using the second copy of the electronic or optical message and the third authentication key; comparing the third authentication tag and the fourth authentication tag; identifying the second copy of the electronic or optical message as being authentic when the third authentication tag matches the fourth authentication tag; and identifying the second copy of the electronic or optical message as not being authentic when the third authentication tag does not match the fourth authentication tag.

14. The system of claim 12 , wherein the authentication authority determines that a communication node prior to the one of the plurality of communication nodes has tampered with the second copy of the electronic or optical message when the authentication authority identifies that the second copy of the electronic or optical message is not authentic when the second copy of the electronic or optical message passes through the one of the plurality of communication nodes of the first switched-path network.

15. The system of claim 12 , wherein the authentication authority determines that a different switched-path network prior to the first switched-path network has tampered with the second copy of the electronic or optical message when the authentication authority identifies that the second copy of the electronic or optical message is not authentic when the second copy of the electronic or optical message passes through the one of the plurality of communication nodes of the first switched-path network.

16. The system of claim 12 , wherein the authentication authority identifies whether the second copy of the electronic or optical message is authentic when the second copy of the electronic or optical message passes through all of the plurality of communication nodes of the first switched-path network in the same manner as when the second copy of the electronic or optical message passes through the one of the plurality of communication nodes of the first switched-path network.

17. The system of claim 12 , wherein the authentication authority receives the first copy of the electronic or optical message directly from the sender to ensure that the first copy of the electronic or optical message is a genuine copy of the electronic or optical message.

18. The system of claim 12 , wherein the authentication authority, after receiving the first copy of the electronic or optical message but before generating the first authentication tag, verifies that the first copy of the electronic or optical message is a genuine copy of the electronic or optical message by authenticating the first copy of the electronic or optical message using the second, end-to-end, authentication key, wherein the first copy of the electronic or optical message comprises an end-to-end authentication tag generated by the sender using the second, end-to-end, authentication key.

19. The system of claim 12 , wherein the authentication authority at least partially authenticates the second copy of the electronic or optical message to enable identification of whether the second copy of the electronic or optical message was tampered with or corrupted by a troublesome communication node that handled the second copy of the electronic or optical message prior to the one of the plurality of communication nodes.

20. The system of claim 12 , wherein the second authentication tag is configured to enable the authentication authority to authenticate the second copy of the electronic or optical message to identify whether the second copy of the electronic or optical message has been tampered with or corrupted upon arrival at that communication node.

21. An optical transport network comprising: a plurality of switched-path optical communication nodes that pass a first copy of an electronic or optical message routed in a switched path through the plurality of switched-path optical communication nodes, wherein at least one of the plurality of switched-path optical communication nodes comprises authentication logic to at least partially authenticate the first copy of the electronic or optical message to enable identification of whether the first copy of the electronic or optical message was tampered with or corrupted by a troublesome communication node that handled the first copy of the electronic or optical message prior to the at least one of the plurality of switched-path optical communication nodes at least partially by: authenticating the first copy of the electronic or optical message itself using a first authentication key also used for end-to-end authentication of the first copy of the electronic or optical message by an end receiver of the first copy of the electronic or optical message; and enabling a third-party authentication authority to authenticate the first copy of the electronic or optical message at least partially by: generating an authentication tag using the first copy of the electronic or optical message and a second authentication key also held by the third-party authentication authority; and sending the authentication tag to the third-party authentication authority to enable the third-party authentication authority to identify whether the first copy of the electronic or optical message is authentic at least partially by comparing the authentication tag to a second authentication tag generated by the third-party authentication authority using the second authentication key and a second copy of the electronic or optical message.

22. The optical transport network of claim 21 , wherein the authentication logic of the at least one of the plurality of switched-path optical communication nodes at least partially authenticates the electronic or optical message by: authenticating the electronic or optical message itself using the second authentication key not used for end-to-end authentication of the electronic or optical message; authenticating the electronic or optical message itself using the first authentication key and the second authentication key; or any combination thereof.

23. The optical transport network of claim 21 , wherein: the authentication logic enables the third-party authentication authority to authenticate the first copy of the electronic or optical message at least partially by: receiving the first copy of the electronic or optical message from a sender; and the third-party authentication authority identifies whether the first copy of the electronic or optical message is authentic at least partially by: receiving the second copy of the electronic or optical message from the sender; receiving the authentication tag from the at least one of the plurality of switched-path optical communication nodes; identifying the first copy of the electronic or optical message as being authentic when the authentication tag matches the second authentication tag; and identifying the first copy of the electronic or optical message as not being authentic when the authentication tag does not match the second authentication tag.

24. The optical transport network of claim 21 , wherein the authentication tag is configured to enable the third-party authentication authority to authenticate the first copy of the electronic or optical message to identify whether the first copy of the electronic or optical message has been tampered with or corrupted upon arrival at the at least one of the plurality of switched-path optical communication nodes.

25. An electronic device comprising: network interface circuitry to enable the electronic device to operate as a communication node in a switched-path network by receiving and forwarding a first copy of an electronic or optical message through the switched-path network; and authentication logic, wherein the authentication logic is tangibly embodied on a non-transitory computer-readable medium that is executed on a processor of the electronic device or programmed onto an integrated circuit, or both, and wherein the authentication logic: generates an authentication tag based on the first copy of the electronic or optical message and an intermediate authentication key, wherein the authentication tag provides sufficient information to enable a third-party authentication authority to authenticate the first copy of the electronic or optical message to identify whether the first copy of the electronic or optical message has been tampered with or corrupted upon receipt at the electronic device at least partially by: receiving a second copy of the electronic or optical message from a sender of the electronic or optical message; generating a second authentication tag using the second copy of the electronic or optical message and the intermediate authentication key; and comparing the authentication tag received from the electronic device and the second authentication tag to identify whether the first copy of the electronic or optical message is authentic; and identifies, independently of the third-party authentication authority, whether the first copy of the electronic or optical message is authentic using an end-to-end authentication key, wherein the first copy of the electronic or optical message comprises an end-to-end authentication tag generated by the sender using the end-to-end authentication key.

26. The electronic device of claim 25 , wherein the network interface circuitry comprises an optical receiver, an optical transmitter, or both, to enable the electronic device to operate as the communication node in the switched-path network, wherein the switched-path network comprises an optical transport network (OTN).

27. The electronic device of claim 25 , wherein the authentication logic authenticates the electronic or optical message using: the end-to-end authentication key that is also used to authenticate the first copy of the electronic or optical message when the first copy of the electronic or optical message reaches a destination beyond the switched-path network; or a second authentication key used in addition to the end-to-end authentication key; or both.

28. The electronic device of claim 25 , wherein the authentication tag provides sufficient information to enable the third-party authentication authority to authenticate the first copy of the electronic or optical message to identify whether the first copy of the electronic or optical message has been tampered with or corrupted upon receipt at the electronic device at least partially by: identifying whether the first copy of the electronic or optical message is authentic when the first copy of the electronic or optical message arrives at the electronic device at least partially by: receiving the authentication tag from the electronic device; identifying the first copy of the electronic or optical message as being authentic when the authentication tag matches the second authentication tag; and identifying the first copy of the electronic or optical message as not being authentic when the authentication tag does not match the second authentication tag.

29. The electronic device of claim 25 , wherein the authentication logic at least partially authenticates the first copy of the electronic or optical message to enable identification of whether the first copy of the electronic or optical message was tampered with or corrupted by a troublesome communication node that handled the first copy of the electronic or optical message prior to the electronic device.

30. An integrated circuit programmed with authentication logic for intermediate authentication of a first copy of an electronic or optical message passing through a communication node along a switched path in a switched-path network, comprising: logic to generate an authentication tag based on the first copy of the electronic or optical message and an intermediate authentication key, wherein the authentication tag provides sufficient information to a third-party authentication authority to authenticate the first copy of the electronic or optical message to identify whether the first copy of the electronic or optical message has been tampered with or corrupted upon receipt at the communication node at least partially by: receiving a second copy of the electronic or optical message from a sender of the electronic or optical message; generating a second authentication tag using the second copy of the electronic or optical message and the intermediate authentication key; and comparing the authentication tag and the second authentication tag to identify whether the first copy of the electronic or optical message is authentic; and logic to identify, independently of the third-party authentication authority, whether the first copy of the electronic or optical message is authentic using an end-to-end authentication key, wherein the first copy of the electronic or optical message comprises an end-to-end authentication tag generated by the sender using the end-to-end authentication key.

31. The integrated circuit of claim 30 , wherein the integrated circuit comprises a programmable logic device and the authentication logic comprises data utilization circuitry of the programmable logic device that has been programmed to include the authentication logic.

32. The integrated circuit of claim 30 , wherein the integrated circuit comprises an application-specific integrated circuit (ASIC).

33. The integrated circuit of claim 30 , wherein the authentication tag provides sufficient information to the third-party authentication authority to authenticate the first copy of the electronic or optical message to identify whether the first copy of the electronic or optical message has been tampered with or corrupted upon receipt at the communication node at least partially by: identifying whether the first copy of the electronic or optical message is authentic when the first copy of the electronic or optical message arrives at the communication node at least partially by: receiving the authentication tag from communication node; comparing the authentication tag and the second authentication tag; identifying the first copy of the electronic or optical message as being authentic when the authentication tag matches the second authentication tag; and identifying the first copy of the electronic or optical message as not being authentic when the authentication tag does not match the second authentication tag.

34. The integrated circuit of claim 30 , wherein the authentication logic comprises logic for at least partially authenticating the first copy of the electronic or optical message to enable identification of whether the first copy of the electronic or optical message was tampered with or corrupted by a troublesome communication node that handled the first copy of the electronic or optical message prior to the communication node.